---
title: "Kamran Shaghaghi (@kam-secops) | Hashnode"
description: "Securing the cloud, one packet at a time. Currently building the future of safe MLOps. Read the latest articles by Kamran Shaghaghi on Hashnode."
url: "https://hashnode.com/@kam-secops"
---

@kam-secops

# Kamran Shaghaghi

@kam-secops · Montreal, Canada · Joined July 2026

Securing the cloud, one packet at a time. Currently building the future of safe MLOps.

### [Containing Autonomous AI: Mitigating OWASP LLM03 (Excessive Agency) with Hardened Linux Security Contexts and GKE Dataplane V2](https://cloudironguard.hashnode.dev/containing-autonomous-ai-mitigating-owasp-llm03-excessive-agency-with-hardened-linux-security-contexts-and-gke-dataplane-v2?utm_source=hashnode&utm_medium=feed)

Mitigate OWASP LLM03 Excessive Agency in autonomous AI agents using hardened GKE Linux security contexts and Cilium eBPF policies.

10 min read · [cloudironguard.hashnode.dev](https://cloudironguard.hashnode.dev/containing-autonomous-ai-mitigating-owasp-llm03-excessive-agency-with-hardened-linux-security-contexts-and-gke-dataplane-v2?utm_source=hashnode&utm_medium=feed)

[Aug 20](https://hashnode.com/posts/containing-autonomous-ai-mitigating-owasp-llm03-excessive-agency-with-hardened-linux-security-contexts-and-gke-dataplane-v2/6a86498b878af9f3764f895b)

### [Mitigating OWASP LLM02: Sensitive Information Disclosure & Cloud Credential Leakage with GKE Workload Identity, CMEK and eBPF Isolation](https://cloudironguard.hashnode.dev/mitigating-owasp-llm02-gke-workload-identity-ebpf?utm_source=hashnode&utm_medium=feed)

Prevent OWASP LLM02 credential leakage in Kubernetes using GKE Workload Identity and Cilium eBPF kernel network policies.

12 min read · [cloudironguard.hashnode.dev](https://cloudironguard.hashnode.dev/mitigating-owasp-llm02-gke-workload-identity-ebpf?utm_source=hashnode&utm_medium=feed)

[Aug 19](https://hashnode.com/posts/mitigating-owasp-llm02-gke-workload-identity-ebpf/6a85044b4226798501c18e6e)

### [Sandboxing AI Agents: Neutralizing OWASP LLM01 (Prompt Injection & System Persistence) with gVisor and Read-Only Filesystems](https://cloudironguard.hashnode.dev/sandboxing-ai-agents-owasp-llm01-gvisor-read-only-filesystem?utm_source=hashnode&utm_medium=feed)

Neutralize OWASP LLM01 prompt injection in Kubernetes by sandboxing AI agents using gVisor microVMs and read-only filesystems.

7 min read · [cloudironguard.hashnode.dev](https://cloudironguard.hashnode.dev/sandboxing-ai-agents-owasp-llm01-gvisor-read-only-filesystem?utm_source=hashnode&utm_medium=feed)

[Aug 17](https://hashnode.com/posts/sandboxing-ai-agents-owasp-llm01-gvisor-read-only-filesystem/6a83377a68a4369575d1ef31)

### [Defending the AI Perimeter: Mitigating OWASP LLM10 (Model Theft & Data Exfiltration) with GKE Dataplane V2 and eBPF](https://cloudironguard.hashnode.dev/mitigating-owasp-llm10-gke-dataplane-v2-ebpf?utm_source=hashnode&utm_medium=feed)

Prevent OWASP LLM10 data exfiltration and model theft in RAG agents using GKE Dataplane V2 eBPF kernel network policies.

8 min read · [cloudironguard.hashnode.dev](https://cloudironguard.hashnode.dev/mitigating-owasp-llm10-gke-dataplane-v2-ebpf?utm_source=hashnode&utm_medium=feed)

[Aug 17](https://hashnode.com/posts/mitigating-owasp-llm10-gke-dataplane-v2-ebpf/6a826fe060330f897d41a11c)

### [Cloud Iron Guard: Building Production-Grade Defense-in-Depth on GKE with Terraform, gVisor, and OPA Gatekeeper](https://cloudironguard.hashnode.dev/gke-defense-in-depth-cloud-iron-guard?utm_source=hashnode&utm_medium=feed)

Architecting, hardening, and verifying an 8-tier zero-trust GKE environment using IaC, gVisor MicroVMs, and OPA Gatekeeper.

8 min read · [cloudironguard.hashnode.dev](https://cloudironguard.hashnode.dev/gke-defense-in-depth-cloud-iron-guard?utm_source=hashnode&utm_medium=feed)

[Aug 3](https://hashnode.com/posts/gke-defense-in-depth-cloud-iron-guard/6a700d15042eec121825ade6)